Consistent core on y2

talks.php.net has code like this:

class display {
     // dump in config values
     function display($c) {
         foreach($c as $k => $v) {
             $this->$k = $v;
         }
     }

     function _php(&$php) {
         if(!empty($php->filename)) include $php->filename;
         else eval('?>'.$php->text);

     }
}

class pdf extends display {

     function pdf($c) {
         parent::display($c);
     }

     // A bunch of other pdf functions ...
}

class pdfus extends pdf {
     function pdfus($c) {
         // US-Letter
         $this->pdf_x = 612;  $this->pdf_y = 792;
         parent::pdf($c);
     }
}

I consistently see this backtrace:

Core was generated by `httpd'.
Program terminated with signal 6, Aborted.
#0  0x0000000800c2101c in kill () from /lib/libc.so.6
#1  0x0000000800c20fc1 in raise () from /lib/libc.so.6
#2  0x0000000800c1fee6 in abort () from /lib/libc.so.6
#3  0x0000000800bc0d05 in _UTF8_init () from /lib/libc.so.6
#4  0x0000000800bc0d48 in _UTF8_init () from /lib/libc.so.6
#5  0x0000000800bc1c71 in _UTF8_init () from /lib/libc.so.6
#6  0x0000000800bc1ee5 in _UTF8_init () from /lib/libc.so.6
#7  0x0000000800bc2005 in free () from /lib/libc.so.6
#8  0x00000008010d5498 in _efree (ptr=0x15f5b) at 
/home/rasmus/php51/Zend/zend_alloc.c:309
#9  0x00000008010f926d in zend_hash_destroy (ht=0x809a18) at 
/home/rasmus/php51/Zend/zend_hash.c:526
#10 0x000000080110571d in zend_object_std_dtor (object=0x848798) at 
/home/rasmus/php51/Zend/zend_objects.c:44
#11 0x0000000801105959 in zend_objects_free_object_storage 
(object=0x848798) at /home/rasmus/php51/Zend/zend_objects.c:111
#12 0x0000000801108716 in zend_objects_store_free_object_storage 
(objects=0x801548370) at /home/rasmus/php51/Zend/zend_objects_API.c:86
#13 0x00000008010e0f19 in shutdown_executor () at 
/home/rasmus/php51/Zend/zend_execute_API.c:281
#14 0x00000008010ee96a in zend_deactivate () at 
/home/rasmus/php51/Zend/zend.c:854
#15 0x00000008010aeb4b in php_request_shutdown (dummy=0x15f5b) at 
/home/rasmus/php51/main/main.c:1287
#16 0x0000000801163f27 in apache_php_module_main (r=0x15f5b, 
display_source_mode=0) at /home/rasmus/php51/sapi/apache/sapi_apache.c:59
#17 0x00000008011649b5 in send_php (r=0x7bd060, display_source_mode=0, 
filename=0x0) at /home/rasmus/php51/sapi/apache/mod_php5.c:661
#18 0x0000000000427cec in ap_invoke_handler ()
#19 0x0000000000439a7c in process_request_internal ()
#20 0x0000000000439bbd in ap_process_request ()
#21 0x000000000043132f in child_main ()
#22 0x00000000004316b9 in make_child ()
#23 0x000000000043295e in standalone_main ()
#24 0x0000000000433453 in main ()

(gdb) frame 10
#10 0x000000080110571d in zend_object_std_dtor (object=0x848798) at 
/home/rasmus/php51/Zend/zend_objects.c:44
44                      zend_hash_destroy(object->properties);
(gdb) p *object->ce
$1 = {type = 2 '\002', name = 0x80470b210 "pdfus", name_length = 5, 
parent = 0x7e9418, refcount = 999, constants_updated = 1 '\001', 
ce_flags = 0,
   function_table = {nTableSize = 32, nTableMask = 31, nNumOfElements = 
23, nNextFreeElement = 0, pInternalPointer = 0x8f5618, pListHead = 
0x8f5618,
     pListTail = 0x81d498, arBuckets = 0xd2da18, pDestructor = 
0x8010e4fe0 <zend_function_dtor>, persistent = 0 '\0', nApplyCount = 0 
'\0',
     bApplyProtection = 0 '\0'}, default_properties = {nTableSize = 8, 
nTableMask = 7, nNumOfElements = 0, nNextFreeElement = 0,
     pInternalPointer = 0x0, pListHead = 0x0, pListTail = 0x0, arBuckets 
= 0x8f5598, pDestructor = 0x8010e04a0 <_zval_ptr_dtor>,
     persistent = 0 '\0', nApplyCount = 0 '\0', bApplyProtection = 0 
'\0'}, properties_info = {nTableSize = 8, nTableMask = 7, nNumOfElements 
= 0,
     nNextFreeElement = 0, pInternalPointer = 0x0, pListHead = 0x0, 
pListTail = 0x0, arBuckets = 0x8f5698,
     pDestructor = 0x8010d5a90 <zend_destroy_property_info>, persistent 
= 0 '\0', nApplyCount = 0 '\0', bApplyProtection = 0 '\0'},
   default_static_members = {nTableSize = 8, nTableMask = 7, 
nNumOfElements = 0, nNextFreeElement = 0, pInternalPointer = 0x0, 
pListHead = 0x0,
     pListTail = 0x0, arBuckets = 0x8f5798, pDestructor = 0x8010e04a0 
<_zval_ptr_dtor>, persistent = 0 '\0', nApplyCount = 0 '\0',
     bApplyProtection = 0 '\0'}, static_members = 0x0, constants_table = 
{nTableSize = 8, nTableMask = 7, nNumOfElements = 0, nNextFreeElement = 0,
     pInternalPointer = 0x0, pListHead = 0x0, pListTail = 0x0, arBuckets 
= 0x8f5718, pDestructor = 0x8010e04a0 <_zval_ptr_dtor>,
     persistent = 0 '\0', nApplyCount = 0 '\0', bApplyProtection = 0 
'\0'}, builtin_functions = 0x0, constructor = 0x7ed118, destructor = 0x0,
   clone = 0x0, __get = 0x0, __set = 0x0, __unset = 0x0, __isset = 0x0, 
__call = 0x0, serialize_func = 0x0, unserialize_func = 0x0,
   iterator_funcs = {funcs = 0x0, new_iterator = 0, zf_new_iterator = 
0x4, zf_valid = 0x3c0, zf_current = 0x0, zf_key = 0x0, zf_next = 
0x800000008,
     zf_rewind = 0x935f58}, create_object = 0, get_iterator = 0, 
interface_gets_implemented = 0, serialize = 0, unserialize = 0,
   interfaces = 0x822bb8, num_interfaces = 0, filename = 0x80471b6b0 
"/home/local/Web/sites/talks.php.net/display.php", line_start = 1959,
   line_end = 1965, doc_comment = 0x0, doc_comment_len = 0, module = 0x0}

I have tried to reproduce this with basically the above code, but so far 
no luck reproducing the crash.  Anybody see anything that stands out? 
I'm not convinced it is APC related at all actually.  It could very well 
be a problem in the pdf extension.

-Rasmus